- Thread starter
- #1
You may have contacted what looked like the customer-support account of a cryptocurrency exchange, wallet, payment service, or financial platform.
The account may have used the company’s name, logo, support language, and even a convincing employee profile.
They told you there was a problem with your account.
Maybe your withdrawal was supposedly blocked.
Maybe your account was allegedly compromised.
Maybe they said your funds needed to be moved to a secure wallet.
Then they gave you a cryptocurrency address, QR code, or payment instruction.
You followed it.
Now the person has stopped responding, your problem was never fixed, and the cryptocurrency you sent is gone.
This is a documented impersonation pattern. The FTC warns that scammers impersonate businesses and other trusted organizations to convince people to send cryptocurrency, while the FBI has specifically warned about criminals impersonating cryptocurrency-exchange support personnel.
If this happened to you, don’t send another payment to the supposed support account.
Jim Recovery Team can review the information you have, identify relevant blockchain transactions, trace known fund movements, and help reconstruct what happened to the cryptocurrency.
If you’re ready, contact [email protected] or +1 (929) 399-9264 on WhatsApp.
If you need time first, preserve the evidence before doing anything else.
STOP CONTACTING THE FAKE SUPPORT ACCOUNT
Don’t keep negotiating with the person who received your cryptocurrency.
They may tell you:
“Your payment hasn’t arrived.”
“You need to send more.”
“That was only a verification payment.”
“You used the wrong network.”
“The wallet needs to be activated.”
“Send a small amount first.”
These explanations can create another opportunity to obtain more cryptocurrency.
The FTC advises consumers not to use contact information supplied in unexpected messages and instead to verify an organization through contact information they already know is genuine.
Your priority now is preserving what happened and identifying the transaction you actually made.
SAVE THE ENTIRE SUPPORT CONVERSATION
Take screenshots of:
The support profile
Username
Display name
Profile photograph
Company logo
Phone number
Email address
Messages
Payment instructions
Wallet address
QR code
Website link
Claimed employee name
Don’t delete the conversation even if the account has already disappeared.
The FBI recommends preserving identifying information, communications, websites, and other details when documenting cryptocurrency fraud.
Once you’ve preserved the conversation, identify the exact cryptocurrency payment you made.
FIND THE CRYPTO TRANSACTION
Open the wallet or exchange you used to send the funds.
Find the transaction connected to the fake support interaction.
Record:
Asset
Amount
Network
Sending wallet
Receiving wallet
Transaction hash
Date and time
For example:
USDT → 7,500 → Tron → Your wallet → Address A → transaction hash
Don’t rely on the amount you remember sending.
Use the blockchain transaction to establish what actually left your wallet.
The FTC notes that blockchain records can contain transaction amounts and sender and recipient wallet addresses.
Once you’ve found the transaction, compare it with the address the fake support account gave you.
VERIFY THE RECEIVING ADDRESS
Check whether:
The address in the message
matches
The address in your transaction
If they match, preserve both.
If they don’t match, don’t assume you made a mistake.
You may have been given a QR code, copied another address, or used an intermediary.
Record exactly what happened.
Also save the network used.
For example:
Message, “Send USDT to Address A on Tron.”
Blockchain, 5,000 USDT sent to Address A on Tron.
That establishes a direct connection between the instruction and the payment.
Once you’ve verified the first destination, follow the cryptocurrency beyond it.
TRACE WHAT HAPPENED AFTER THE PAYMENT
The receiving wallet may have moved the cryptocurrency quickly.
A possible sequence could be:
Your wallet
↓
Address A
↓
Address B
↓
Address C
Or:
Your wallet
↓
Address A
↓
Token swap
↓
Address B
Don’t stop at the first receiving address.
Record subsequent movements you can verify.
The FBI says transaction details such as wallet addresses, cryptocurrency type and amount, dates and times, and transaction hashes are among the most important information to preserve when reporting cryptocurrency fraud.
Once you’ve followed the first movement, establish exactly what the supposed support representative claimed they were doing.
DOCUMENT THE SUPPORT STORY
Maybe they said:
“Your account has been compromised.”
“Move your funds to this secure wallet.”
“We need to verify ownership.”
“Send a small amount to unlock your account.”
“Your withdrawal is stuck.”
“Pay the network fee.”
“Send the funds to our recovery wallet.”
Save the exact wording.
Don’t summarize it from memory.
The purpose is to establish the reason you were given for sending cryptocurrency.
Once you’ve documented the story, verify whether the real company ever contacted you.
CONTACT THE REAL COMPANY THROUGH A KNOWN CHANNEL
Don’t use:
The phone number in the suspicious message
The support link they sent
The email address they provided
The social-media account that contacted you
Instead, use contact information you already know belongs to the company, such as the official website or the support channel inside your genuine account.
The FTC specifically recommends independently contacting the organization through a phone number, website, or email address you know is real rather than using information supplied in an unexpected message.
Ask whether the communication actually came from them.
Don’t give the supposed support account another opportunity to obtain information from you.
CHECK WHETHER YOU SHARED ACCOUNT INFORMATION
Think about everything the fake representative requested.
Did you provide:
Username
Password
Email
Phone number
Two-factor authentication code
One-time passcode
Recovery phrase
Private key
Remote-access permission
Screenshots of your account
Some impersonation scams are designed to obtain account access rather than cryptocurrency directly.
The FBI has documented support-impersonation schemes in which criminals obtain account credentials and then move funds into cryptocurrency wallets.
If you shared credentials, secure the genuine account through the company’s real support channel.
CHANGE COMPROMISED CREDENTIALS
If you gave the fake representative a password or login information, don’t continue using that password.
Change it through the legitimate service.
If the same password was used elsewhere, change those accounts too.
If you provided a two-factor authentication code, tell the genuine company exactly what happened.
If you gave someone remote access to a device, disconnect that access and review the device for anything that was installed or changed.
Do not give the fake support account another verification code while trying to fix the problem.
CHECK YOUR WALLET FOR OTHER UNAUTHORIZED ACTIVITY
Sending cryptocurrency to a fake support account doesn’t necessarily mean the wallet itself was compromised.
But check anyway.
Look for:
Unknown transfers
Token approvals
Unexpected swaps
Unfamiliar contract interactions
Other assets leaving the wallet
If you see another transaction you did not authorize, preserve it separately.
For example:
Support payment → 5,000 USDT
Later unauthorized transfer → 2 ETH
Those may require different investigation.
Once you’ve checked the wallet, calculate exactly what you sent to the fake support account.
SEPARATE THE SUPPORT PAYMENT FROM OTHER LOSSES
Create a simple record:
Original payment → 5,000 USDT
Second payment → 1,000 USDT
Actual withdrawal received → 0
Other unauthorized transfer → 2 ETH
Don’t combine everything into one unexplained loss figure.
Separate:
Payments you intentionally made because of the impersonation
from
Transfers you did not authorize
from
Funds that were actually returned
This creates a much clearer transaction history.
Once you’ve separated the payments, connect each one to the support message that caused it.
CONNECT EACH PAYMENT TO THE REQUEST
For every payment, record:
What did they tell you?
What amount did they request?
Which address did they provide?
What did they say would happen afterward?
What actually happened?
For example:
Support account, “Send 5,000 USDT to secure your account.”
5,000 USDT sent.
Account remained inaccessible.
Support account, “Send another 500 USDT for verification.”
500 USDT sent.
No access restored.
This shows the progression instead of simply recording that you lost money.
Once you’ve mapped the requests, preserve the fake support account’s identity.
DOCUMENT THE IMPERSONATION
Save:
Exact account name
Username
Profile URL
Email
Phone number
Company name used
Claimed employee name
Logo
Profile photograph
Website
Payment address
QR code
If the account disappears, your screenshots may preserve the evidence needed to identify how it presented itself.
The FBI recommends providing identifiers such as names, phone numbers, email addresses, usernames, websites, and communication records when reporting cryptocurrency fraud.
Once you’ve preserved the identity, document how the fake support account first contacted you.
FIND THE FIRST CONTACT
Maybe you:
Searched for customer support
Clicked a sponsored search result
Responded to a social-media account
Posted publicly asking for help
Received an unsolicited message
Joined a Telegram or Discord group
Clicked a support link
Called a number displayed online
Record exactly what happened.
This can matter because impersonators sometimes create fake support pages, advertisements, accounts, and phone numbers that appear connected to legitimate companies. The FBI has documented fraudulent support schemes involving cryptocurrency exchanges and fake support channels.
Once you’ve identified the first contact, preserve the link or advertisement that brought you there.
SAVE THE ORIGINAL SUPPORT LINK
Keep:
URL
Search result
Advertisement
Social-media post
Profile
Website
Phone number
QR code
Don’t revisit suspicious links simply to collect more evidence.
A screenshot of the original link may be enough.
If you found the account through a search engine, preserve what you saw rather than assuming the result was an official company listing.
Once you’ve preserved the source, document exactly when the payment occurred.
BUILD THE TIMELINE
A useful timeline might look like:
10:02 → searched for support
10:05 → contacted support account
10:08 → representative claimed account was compromised
10:12 → wallet address provided
10:15 → 5,000 USDT sent
10:17 → representative requested another payment
10:25 → second payment sent
10:40 → representative stopped responding
11:00 → genuine company confirmed the account was not theirs
The exact details will depend on your situation.
The purpose is to connect:
support request → impersonation → payment instruction → blockchain transaction → disappearance
Once the timeline is complete, preserve the transaction hashes alongside it.
KEEP THE BLOCKCHAIN RECORD WITH THE COMMUNICATION
For each payment, keep:
Support message
+
Wallet address
+
Transaction hash
+
Amount
+
Timestamp
For example:
“Send 5,000 USDT to this address.”
→ screenshot
→ receiving address
→ 5,000 USDT transaction
→ transaction hash
This creates a direct evidence chain between what the impersonator requested and what actually happened on-chain.
Once you’ve organized the evidence, contact the exchange or payment service you used to send the cryptocurrency.
CONTACT THE EXCHANGE OR ATM OPERATOR IMMEDIATELY
If you purchased or sent the cryptocurrency through an exchange or cryptocurrency ATM, contact the provider as soon as possible.
Tell them the payment was fraudulent.
Provide:
Transaction hash
Receiving address
Amount
Asset
Date and time
Details of the impersonation
The FTC advises people who paid a scammer with cryptocurrency to contact the cryptocurrency exchange or ATM operator immediately, report the fraudulent transaction, and ask whether it can be reversed or refunded.
Don’t assume a reversal is possible.
The important point is to notify the provider quickly and give them the transaction information they need.
Once you’ve contacted the payment provider, preserve any case number or response they give you.
SAVE THE PROVIDER’S RESPONSE
Keep:
Case number
Support ticket
Email
Transaction review
Fraud determination
Instructions
Date you contacted them
This becomes part of your evidence file.
Don’t delete it even if the provider says the transaction cannot be reversed.
Once you’ve preserved that response, be careful about anyone who later claims they can recover the cryptocurrency.
WATCH FOR A SECOND RECOVERY SCAM
After a fake support account takes your cryptocurrency, you may be contacted by another person claiming:
“We found the wallet.”
“We can recover your crypto.”
“The exchange has released the funds.”
“Pay a tracing fee first.”
“Send cryptocurrency to activate the recovery.”
Be cautious with unexpected recovery offers.
The FBI warns that cryptocurrency victims are frequently targeted by fraudulent recovery services that claim they can recover lost funds for a fee.
Don’t send another cryptocurrency payment simply because someone promises guaranteed recovery.
Your original transaction evidence should remain the foundation of the investigation.
YOU DON’T NEED TO HAVE EVERYTHING FIGURED OUT
You may only have:
One fake support account
One wallet address
One transaction hash
Screenshots
A phone number
A few messages
That’s enough to start organizing the incident.
Jim Recovery Team can review the available information, identify relevant blockchain transactions, trace known fund movements, and help reconstruct the payment sequence.
If you’re ready for professional assistance, contact [email protected] or +1 (929) 399-9264 on WhatsApp with whatever information you currently have.
If you’re not ready, preserve the evidence first.
WHAT YOUR EVIDENCE SHOULD SHOW
Ideally, your records should establish:
How you looked for support
↓
How the fake account presented itself
↓
What problem they claimed existed
↓
What cryptocurrency they told you to send
↓
Which address they provided
↓
What you actually sent
↓
Where the cryptocurrency moved afterward
↓
Whether you shared credentials or other information
↓
Whether additional payments were requested
↓
What happened after you stopped paying
You don’t need a perfect evidence file.
You need a clear connection between the impersonator’s instructions and the blockchain transactions.
The most useful question isn’t simply “How do I get my crypto back?”
It’s:
“Who contacted me, how did they impersonate the real support service, what did they tell me to do, what cryptocurrency did I send, and where did those funds move afterward?”
Start there, preserve everything, contact the legitimate payment provider through a known channel, and don’t send another payment under pressure.
The account may have used the company’s name, logo, support language, and even a convincing employee profile.
They told you there was a problem with your account.
Maybe your withdrawal was supposedly blocked.
Maybe your account was allegedly compromised.
Maybe they said your funds needed to be moved to a secure wallet.
Then they gave you a cryptocurrency address, QR code, or payment instruction.
You followed it.
Now the person has stopped responding, your problem was never fixed, and the cryptocurrency you sent is gone.
This is a documented impersonation pattern. The FTC warns that scammers impersonate businesses and other trusted organizations to convince people to send cryptocurrency, while the FBI has specifically warned about criminals impersonating cryptocurrency-exchange support personnel.
If this happened to you, don’t send another payment to the supposed support account.
Jim Recovery Team can review the information you have, identify relevant blockchain transactions, trace known fund movements, and help reconstruct what happened to the cryptocurrency.
If you’re ready, contact [email protected] or +1 (929) 399-9264 on WhatsApp.
If you need time first, preserve the evidence before doing anything else.
STOP CONTACTING THE FAKE SUPPORT ACCOUNT
Don’t keep negotiating with the person who received your cryptocurrency.
They may tell you:
“Your payment hasn’t arrived.”
“You need to send more.”
“That was only a verification payment.”
“You used the wrong network.”
“The wallet needs to be activated.”
“Send a small amount first.”
These explanations can create another opportunity to obtain more cryptocurrency.
The FTC advises consumers not to use contact information supplied in unexpected messages and instead to verify an organization through contact information they already know is genuine.
Your priority now is preserving what happened and identifying the transaction you actually made.
SAVE THE ENTIRE SUPPORT CONVERSATION
Take screenshots of:
The support profile
Username
Display name
Profile photograph
Company logo
Phone number
Email address
Messages
Payment instructions
Wallet address
QR code
Website link
Claimed employee name
Don’t delete the conversation even if the account has already disappeared.
The FBI recommends preserving identifying information, communications, websites, and other details when documenting cryptocurrency fraud.
Once you’ve preserved the conversation, identify the exact cryptocurrency payment you made.
FIND THE CRYPTO TRANSACTION
Open the wallet or exchange you used to send the funds.
Find the transaction connected to the fake support interaction.
Record:
Asset
Amount
Network
Sending wallet
Receiving wallet
Transaction hash
Date and time
For example:
USDT → 7,500 → Tron → Your wallet → Address A → transaction hash
Don’t rely on the amount you remember sending.
Use the blockchain transaction to establish what actually left your wallet.
The FTC notes that blockchain records can contain transaction amounts and sender and recipient wallet addresses.
Once you’ve found the transaction, compare it with the address the fake support account gave you.
VERIFY THE RECEIVING ADDRESS
Check whether:
The address in the message
matches
The address in your transaction
If they match, preserve both.
If they don’t match, don’t assume you made a mistake.
You may have been given a QR code, copied another address, or used an intermediary.
Record exactly what happened.
Also save the network used.
For example:
Message, “Send USDT to Address A on Tron.”
Blockchain, 5,000 USDT sent to Address A on Tron.
That establishes a direct connection between the instruction and the payment.
Once you’ve verified the first destination, follow the cryptocurrency beyond it.
TRACE WHAT HAPPENED AFTER THE PAYMENT
The receiving wallet may have moved the cryptocurrency quickly.
A possible sequence could be:
Your wallet
↓
Address A
↓
Address B
↓
Address C
Or:
Your wallet
↓
Address A
↓
Token swap
↓
Address B
Don’t stop at the first receiving address.
Record subsequent movements you can verify.
The FBI says transaction details such as wallet addresses, cryptocurrency type and amount, dates and times, and transaction hashes are among the most important information to preserve when reporting cryptocurrency fraud.
Once you’ve followed the first movement, establish exactly what the supposed support representative claimed they were doing.
DOCUMENT THE SUPPORT STORY
Maybe they said:
“Your account has been compromised.”
“Move your funds to this secure wallet.”
“We need to verify ownership.”
“Send a small amount to unlock your account.”
“Your withdrawal is stuck.”
“Pay the network fee.”
“Send the funds to our recovery wallet.”
Save the exact wording.
Don’t summarize it from memory.
The purpose is to establish the reason you were given for sending cryptocurrency.
Once you’ve documented the story, verify whether the real company ever contacted you.
CONTACT THE REAL COMPANY THROUGH A KNOWN CHANNEL
Don’t use:
The phone number in the suspicious message
The support link they sent
The email address they provided
The social-media account that contacted you
Instead, use contact information you already know belongs to the company, such as the official website or the support channel inside your genuine account.
The FTC specifically recommends independently contacting the organization through a phone number, website, or email address you know is real rather than using information supplied in an unexpected message.
Ask whether the communication actually came from them.
Don’t give the supposed support account another opportunity to obtain information from you.
CHECK WHETHER YOU SHARED ACCOUNT INFORMATION
Think about everything the fake representative requested.
Did you provide:
Username
Password
Phone number
Two-factor authentication code
One-time passcode
Recovery phrase
Private key
Remote-access permission
Screenshots of your account
Some impersonation scams are designed to obtain account access rather than cryptocurrency directly.
The FBI has documented support-impersonation schemes in which criminals obtain account credentials and then move funds into cryptocurrency wallets.
If you shared credentials, secure the genuine account through the company’s real support channel.
CHANGE COMPROMISED CREDENTIALS
If you gave the fake representative a password or login information, don’t continue using that password.
Change it through the legitimate service.
If the same password was used elsewhere, change those accounts too.
If you provided a two-factor authentication code, tell the genuine company exactly what happened.
If you gave someone remote access to a device, disconnect that access and review the device for anything that was installed or changed.
Do not give the fake support account another verification code while trying to fix the problem.
CHECK YOUR WALLET FOR OTHER UNAUTHORIZED ACTIVITY
Sending cryptocurrency to a fake support account doesn’t necessarily mean the wallet itself was compromised.
But check anyway.
Look for:
Unknown transfers
Token approvals
Unexpected swaps
Unfamiliar contract interactions
Other assets leaving the wallet
If you see another transaction you did not authorize, preserve it separately.
For example:
Support payment → 5,000 USDT
Later unauthorized transfer → 2 ETH
Those may require different investigation.
Once you’ve checked the wallet, calculate exactly what you sent to the fake support account.
SEPARATE THE SUPPORT PAYMENT FROM OTHER LOSSES
Create a simple record:
Original payment → 5,000 USDT
Second payment → 1,000 USDT
Actual withdrawal received → 0
Other unauthorized transfer → 2 ETH
Don’t combine everything into one unexplained loss figure.
Separate:
Payments you intentionally made because of the impersonation
from
Transfers you did not authorize
from
Funds that were actually returned
This creates a much clearer transaction history.
Once you’ve separated the payments, connect each one to the support message that caused it.
CONNECT EACH PAYMENT TO THE REQUEST
For every payment, record:
What did they tell you?
What amount did they request?
Which address did they provide?
What did they say would happen afterward?
What actually happened?
For example:
Support account, “Send 5,000 USDT to secure your account.”
5,000 USDT sent.
Account remained inaccessible.
Support account, “Send another 500 USDT for verification.”
500 USDT sent.
No access restored.
This shows the progression instead of simply recording that you lost money.
Once you’ve mapped the requests, preserve the fake support account’s identity.
DOCUMENT THE IMPERSONATION
Save:
Exact account name
Username
Profile URL
Phone number
Company name used
Claimed employee name
Logo
Profile photograph
Website
Payment address
QR code
If the account disappears, your screenshots may preserve the evidence needed to identify how it presented itself.
The FBI recommends providing identifiers such as names, phone numbers, email addresses, usernames, websites, and communication records when reporting cryptocurrency fraud.
Once you’ve preserved the identity, document how the fake support account first contacted you.
FIND THE FIRST CONTACT
Maybe you:
Searched for customer support
Clicked a sponsored search result
Responded to a social-media account
Posted publicly asking for help
Received an unsolicited message
Joined a Telegram or Discord group
Clicked a support link
Called a number displayed online
Record exactly what happened.
This can matter because impersonators sometimes create fake support pages, advertisements, accounts, and phone numbers that appear connected to legitimate companies. The FBI has documented fraudulent support schemes involving cryptocurrency exchanges and fake support channels.
Once you’ve identified the first contact, preserve the link or advertisement that brought you there.
SAVE THE ORIGINAL SUPPORT LINK
Keep:
URL
Search result
Advertisement
Social-media post
Profile
Website
Phone number
QR code
Don’t revisit suspicious links simply to collect more evidence.
A screenshot of the original link may be enough.
If you found the account through a search engine, preserve what you saw rather than assuming the result was an official company listing.
Once you’ve preserved the source, document exactly when the payment occurred.
BUILD THE TIMELINE
A useful timeline might look like:
10:02 → searched for support
10:05 → contacted support account
10:08 → representative claimed account was compromised
10:12 → wallet address provided
10:15 → 5,000 USDT sent
10:17 → representative requested another payment
10:25 → second payment sent
10:40 → representative stopped responding
11:00 → genuine company confirmed the account was not theirs
The exact details will depend on your situation.
The purpose is to connect:
support request → impersonation → payment instruction → blockchain transaction → disappearance
Once the timeline is complete, preserve the transaction hashes alongside it.
KEEP THE BLOCKCHAIN RECORD WITH THE COMMUNICATION
For each payment, keep:
Support message
+
Wallet address
+
Transaction hash
+
Amount
+
Timestamp
For example:
“Send 5,000 USDT to this address.”
→ screenshot
→ receiving address
→ 5,000 USDT transaction
→ transaction hash
This creates a direct evidence chain between what the impersonator requested and what actually happened on-chain.
Once you’ve organized the evidence, contact the exchange or payment service you used to send the cryptocurrency.
CONTACT THE EXCHANGE OR ATM OPERATOR IMMEDIATELY
If you purchased or sent the cryptocurrency through an exchange or cryptocurrency ATM, contact the provider as soon as possible.
Tell them the payment was fraudulent.
Provide:
Transaction hash
Receiving address
Amount
Asset
Date and time
Details of the impersonation
The FTC advises people who paid a scammer with cryptocurrency to contact the cryptocurrency exchange or ATM operator immediately, report the fraudulent transaction, and ask whether it can be reversed or refunded.
Don’t assume a reversal is possible.
The important point is to notify the provider quickly and give them the transaction information they need.
Once you’ve contacted the payment provider, preserve any case number or response they give you.
SAVE THE PROVIDER’S RESPONSE
Keep:
Case number
Support ticket
Transaction review
Fraud determination
Instructions
Date you contacted them
This becomes part of your evidence file.
Don’t delete it even if the provider says the transaction cannot be reversed.
Once you’ve preserved that response, be careful about anyone who later claims they can recover the cryptocurrency.
WATCH FOR A SECOND RECOVERY SCAM
After a fake support account takes your cryptocurrency, you may be contacted by another person claiming:
“We found the wallet.”
“We can recover your crypto.”
“The exchange has released the funds.”
“Pay a tracing fee first.”
“Send cryptocurrency to activate the recovery.”
Be cautious with unexpected recovery offers.
The FBI warns that cryptocurrency victims are frequently targeted by fraudulent recovery services that claim they can recover lost funds for a fee.
Don’t send another cryptocurrency payment simply because someone promises guaranteed recovery.
Your original transaction evidence should remain the foundation of the investigation.
YOU DON’T NEED TO HAVE EVERYTHING FIGURED OUT
You may only have:
One fake support account
One wallet address
One transaction hash
Screenshots
A phone number
A few messages
That’s enough to start organizing the incident.
Jim Recovery Team can review the available information, identify relevant blockchain transactions, trace known fund movements, and help reconstruct the payment sequence.
If you’re ready for professional assistance, contact [email protected] or +1 (929) 399-9264 on WhatsApp with whatever information you currently have.
If you’re not ready, preserve the evidence first.
WHAT YOUR EVIDENCE SHOULD SHOW
Ideally, your records should establish:
How you looked for support
↓
How the fake account presented itself
↓
What problem they claimed existed
↓
What cryptocurrency they told you to send
↓
Which address they provided
↓
What you actually sent
↓
Where the cryptocurrency moved afterward
↓
Whether you shared credentials or other information
↓
Whether additional payments were requested
↓
What happened after you stopped paying
You don’t need a perfect evidence file.
You need a clear connection between the impersonator’s instructions and the blockchain transactions.
The most useful question isn’t simply “How do I get my crypto back?”
It’s:
“Who contacted me, how did they impersonate the real support service, what did they tell me to do, what cryptocurrency did I send, and where did those funds move afterward?”
Start there, preserve everything, contact the legitimate payment provider through a known channel, and don’t send another payment under pressure.